Data storage devices such as hard drives and solid state drives may store data separated into groups referred to as sectors, which may be further separated into subgroups referred to as blocks. Generally, the sectors and blocks are filled with data indicated as binary bits (1's and 0's). When the bits are combined into a string of bits (e.g. 10101010), they form words or bytes, which in turn, form computer files that end users of computing machines may utilize.
During a forensic investigation, data stored in a storage device under investigation may be processed, for example, for searching, indexing, or the like. During such processing, all sectors or blocks of the data storage device are typically processed. However, not all blocks may contain useful data. For example, the blocks may sometime store pattern(s) (e.g. 11001100), or be empty, thus containing all binary 0's (which is also a pattern). Efficiency when searching the data storage device may be improved if the sectors and/or blocks that do not contain data predicted to be useful, may be skipped. Accordingly, what is desired is a system and method for reviewing computer data acquired from a data storage device in a more efficient manner.